Mailinglist Archive: opensuse-updates (121 mails)

< Previous Next >
openSUSE-SU-2017:0354-1: moderate: Security update for MozillaThunderbird
openSUSE Security Update: Security update for MozillaThunderbird

Announcement ID: openSUSE-SU-2017:0354-1
Rating: moderate
References: #1021814 #1021817 #1021818 #1021819 #1021820
#1021821 #1021822 #1021824 #1021991
Cross-References: CVE-2017-5373 CVE-2017-5375 CVE-2017-5376
CVE-2017-5378 CVE-2017-5380 CVE-2017-5383
CVE-2017-5390 CVE-2017-5396
Affected Products:
SUSE Package Hub for SUSE Linux Enterprise 12

An update that solves 8 vulnerabilities and has one errata
is now available.


This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs.

The following security issues from advisory MFSA 2017-03 were fixed
(boo#1021991) In general, these flaws cannot be exploited through email in
Thunderbird because scripting is disabled when reading mail, but are
potentially risks in browser or browser-like contexts:

- CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and
DEP (boo#1021814)
- CVE-2017-5376: Use-after-free in XSL (boo#1021817)
- CVE-2017-5378: Pointer and frame data leakage of Javascript objects
- CVE-2017-5380: Potential use-after-free during DOM manipulations
- CVE-2017-5390: Insecure communication methods in Developer Tools JSON
viewer (boo#1021820)
- CVE-2017-5396: Use-after-free with Media Decoder (boo#1021821)
- CVE-2017-5383: Location bar spoofing with unicode characters
- CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7 (boo#1021824)

The following non-security bugs were fixed:

- Message preview pane non-functional after IMAP folder was renamed or
- "Move To" button on "Search Messages" panel not working
- Message sent to "undisclosed recipients" shows no recipient
(non-functional since Thunderbird version 38)

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2017-188=1

To bring your system up-to-date, use "zypper patch".

Package List:

- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64):


- SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64):


- SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):



< Previous Next >
List Navigation
This Thread
  • No further messages